PT-2026-141185

CVE-2026-125362

·

Published

2026-11-09

·

Updated

2026-11-10

Description by

CVSS 3.1
3.1
Low
MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Related identifiers
CVE-2026-125362
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com